Skip to navigation Skip to content



In this article

HIPAA: Health Insurance Portability and Accountability Act

This section helps explain the protections provided by the Health Insurance Portability and Accountability Act (HIPAA), an important federal law for everyone, and especially people with pre-existing health conditions.

HIPAA guarantees rights to individual or group coverage under certain circumstances

HIPAA is a complex federal law that assures people with pre-existing health conditions the ability to get health coverage under certain circumstances. Most of HIPAA’s provisions offer protections to people in  employer-based and other group health plans. But you cannot be turned down for coverage even if you are trying to buy insurance on your own despite your pre-existing condition if you:

  • Had at least 18 months of prior coverage from an employer or other group;
  • Have used up your COBRA or state continuation coverage rights; and
  • Had no gaps in coverage lasting longer than 63 days.  
  • Are not eligible for Medicare, Medicaid or a group health plan.

If you meet this criteria, you are considered ‘HIPAA eligible’ and your state must guarantee some health coverage to its HIPAA eligible residents. State governments have responded to HIPAA’s requirements  in different ways, and as a result, coverage for individuals in these circumstances usually comes in the form of a High Risk Pool or individual insurance. These options are often open to individuals who are not HIPAA eligible as well, but with different requirements. Check this state-by-state guide, or call your State Department of Insurance to learn more about your rights to purchase health coverage in your state.   

HIPAA limits the impact of pre-existing conditions for people in group health plans

Although not required to do so by law, most employers offer group health benefits to their employees. New employees can enroll in or decline these benefits, but most people enroll as soon as possible.

Penalties for enrolling late are common. They are meant to discourage employees from participating in group health plans only if or when they (or a dependent) get sick. HIPAA also protects your medical privacy, which is not addressed here.

HIPAA's anti-discrimination protections

HIPAA guarantees that an individual cannot be denied enrollment in a group health plan on the basis of his/her health status, nor can she/he be charged a higher premium due to poor health. In other words, no one can be singled out and charged more or excluded from participating in an employer's group health plan no matter what health condition that individual may have. This goes a long way toward preserving fairness in the system.

Limits on pre-existing condition exclusions

If you have ever read the list of "exclusions" in a typical health insurance policy, you may have been concerned or confused. Indeed, before HIPAA set some limits for exclusions in employee group health policies, many people were effectively locked into their jobs for fear of losing health insurance. HIPAA defines a pre-existing condition as "a condition (whether physical or mental),. . . for which medical advice, diagnosis, care or treatment were recommended or received within the six-month period ending on the enrollment date." Simply stated, it is any health condition for which you saw or consulted a health professional or were treated-which includes taking a prescribed medication-within the six-month period before your new plan started.

A pre-existing condition exclusion is the period of time that a health plan is not responsible for covering the costs of a pre-existing condition. Very significantly, HIPAA does not ban exclusion periods. It limits them to no more than 12 months for first-time enrollment in a health plan, and 18 months for late enrollment (enrollment after or between open enrollment periods).

HIPAA also established a concept called creditable coverage. This gives you (or your covered dependents) credit for the amount of time you were insured by one plan (called prior coverage) and applies it to the pre-existing condition exclusion period of a new plan. Prior coverage is not creditable if there is a gap of 63 or more consecutive days without coverage. These three scenarios show how it works:
  • Marian was diagnosed with MS while she was working for ABC Corporation and was insured by ABC's group health plan. After three years with ABC, she took a job with DEF International and enrolled in their group health plan. Marian had a gap of just nine days between her ABC coverage and the start date of DEF's group plan. DEF's plan excluded pre-existing conditions for the first twelve months, but HIPPA allowed her to apply her prior coverage from ABC to DEF's pre-existing condition exclusion period.
  • Annette, who also has MS, was covered by her husband Greg's group health plan for the ten months he worked for ABC. Then he was laid off. They did not elect COBRA because they could not afford it. Greg got a new job with XYZ that offered health benefits to its workers and dependents. He enrolled in the XYZ plan, but there was a 24-day gap in coverage. The XYZ plan also had a twelve-month pre-existing condition exclusion. HIPAA enabled Greg to deduct the ten months of Annette's prior coverage from the twelve-month exclusion period. They had to absorb uncovered costs for two months, at which point the exclusion period was finished and full coverage from XYZ kicked in.
  • Janet lost her job and health benefits when her employer downsized. She did not elect COBRA because of the expense. Janet found another job three months later. Because more than 63 days had elapsed between the two plans, Janet did not get any credit for her prior coverage. She had no insurance for MS related health-care expenses for a full year. Other medical costs Janet incurred during that period not related to her MS were covered by her new plan.
If Annette or Janet had elected COBRA, they would have remained covered until their new group coverage took over. This is why it is so important for people with MS or other expensive health conditions to elect their COBRA benefits to stay covered, and not allow themselves to be completely without coverage for 63 days or more.

Demonstrating prior coverage

HIPAA requires health plans to make this system work. When a covered employee, spouse, or covered dependent leave a plan, they must be given a Certificate of Coverage indicating the amount of time each individual had coverage. If you or a dependent have MS (or any another pre-existing condition) this certificate is the proof of prior coverage that you can apply toward a pre-existing condition exclusion period. Most but not all health plans have these exclusion periods, although some are shorter than the maximum permitted by HIPAA. The law requires all health plans to provide these certificates within a "reasonable" time. You should expect it shortly after leaving the job or at the end of the COBRA period (if elected).

Who does HIPAA cover?

HIPAA's protections apply to most health plans, including employment-related group policies, union and association plans, individual policies, Medicare, Medicaid, high-risk pool insurance, coverage provided by a foreign government and more. But there are some exceptions. So-called temporary health policies, certain student plans, catastrophic or disease-specific policies, private disability policies, and dental or vision coverage, are not considered creditable coverage under HIPAA.

When considering the purchase of any health-insurance policy, ask if it would be considered "creditable coverage" under HIPAA. Consult your employer, health plan administrator, or your state department of health for more details about HIPAA protections.

Health and Medical Privacy Guides

Privacy Rights Clearinghouse's health and medical privacy guides

Privacy Guides

Privacy Guides


The National MS Society is Here to Help

Newly Diagnosed
If you or somone close to you has recently been diagnosed, access our MS information and resources.

Start Here

Start Here
© 2024 The National Multiple Sclerosis Society is a tax exempt 501(c)3 nonprofit organization. Its Identification Number (EIN) is 13-5661935.